4 ms·

Intel SGX is really a big gift to security researchers, second only to speculative execution and friends. Intel is selling it as a way to keep secrets safe insi

Intel SGX is really a big gift to security researchers, second only to speculative execution and friends. Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. SGX has opened Intel up to physical attacks on the chip in a way that really hasn’t been interesting in the past. Previously attacking a CPU physically wouldn’t give you any more capabilities than you already had (with unlimited ability to tamper I/O and memory). Now, physically attacking the CPU can be used to reveal SGX secrets or mess with SGX computations. Expect a lot more attacks like this to come out in the future!

bluegreyred 7y ago
> Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. As a layman I have to wonder, should we expect similar attacks on Apple's Secure Enclave in the future?
- Twisell 7y ago
  Interesting question would love to read some insights about that too. From my really basic understanding Apple Secure Enclave is a co-processor so other rules should apply but I'm also a poor layman in hardware design.
- kohtatsu 7y ago
  Apple's Secure Enclave is a coprocessor designed specifically to reduce attack surface, and minimize the surface area of untrusted code. It physically separates the ephemeral secret-storing (touch/face ID) and the hardcoded crypto keys (not even the SE firmware has access to the key material, it's just allowed to run the circuits). Check out the iOS Security Guide whitepaper.
- deleted 7y ago
  [deleted]
- fpoling 7y ago
  It greatly helps Apple that T2 is a separated chip specially designed to do one function well, that is to do crypto in a secure way even in presence of physical attacks. How to do that has been known for quite some time. For example, modern SIM cards or cards for satellite tv are very secure and a physical attack is possible if one is willing to spend like over 100K per card. What Intel is trying to do is to allow a general purpose secure computing with minimal extra cost. This is relatively new and as various bugs demonstrates may not even archivable. I.e. it may be possible to create provably secure chip, but its cost will make it a niche product.
  - baybal2 7y ago
    > physical attack is possible if one is willing to spend like over 100K per card. Firmware recovery from "hardened" microcontrollers costs $15-25k here, and even that's most likely a "special foreigner price"
    - baby 7y ago
      It’s not about firmware recovery: it’s about tampering it in a non-intrusive way OR extracting keys from its secured non volatile memory.
      - baybal2 7y ago
        Yes, MCU with intentionally hardened flash blocks are what those firmware recoverers specialize. They do things like gemalto chips sim and credit cards.
        baby 7y ago
        the firmware should not be in internal flash though, where the keys are
  - baby 7y ago
    It looks to me that having a standalone chip is not great in general due to hardware attacks: you can easily MITM the system bus for example. Whereas a number of attacks become much harder once you use an integrated secure element. The form factor of the iPhone of course almost makes the T2 secure enclave an integrated secure module. I also don’t think hardware attacks are really considered anyway (and as we see most researchers focus on software attacks)
matheusmoreira 7y ago
> Expect a lot more attacks like this to come out in the future! Hopefully SGX will be so utterly broken they'll never make anything like it ever again.
- josteink 7y ago
  Every time someone has uncovered a defect in Intel’s highest authoritative security-component, the answer has always been to add yet another, even more privileged component on top of that, to fix things “once and for all”. The current standing is a overly complex Rube Goldberg contraption obviously not fit to the task at hand. And Intel can’t or won’t fix it because if compatibility. And since each new component is even more privileged, it automatically becomes an even more valuable target to hack. So expect the contraption to get worse, not better. Even if everyone (probably Intel engineers too) agrees it’s the wrong thing to do.
lima 7y ago
AMD SEV has the same problem, with an even larger attack surface. But - at least it's compatible with the rest of the world, since it runs ordinary VMs, and can be used as a drop-in defense-in-depth measure. Intel SGX, on the other hand, is a severely constrained alien environment and porting stuff to run in SGX is a massive undertaking, requiring special compilers and SDKs. The cost-benefit calculation does not add up, given that it does not provide the level of security it claims to have. I wouldn't be surprised if SEV will eventually be adopted as the industry standard, while SGX disappears into irrelevance.

bluegreyred 7y ago

> Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. As a layman I have to wonder, should we expect similar attacks on Apple's Secure Enclave in the future?

Twisell 7y ago
Interesting question would love to read some insights about that too. From my really basic understanding Apple Secure Enclave is a co-processor so other rules should apply but I'm also a poor layman in hardware design.
kohtatsu 7y ago
Apple's Secure Enclave is a coprocessor designed specifically to reduce attack surface, and minimize the surface area of untrusted code. It physically separates the ephemeral secret-storing (touch/face ID) and the hardcoded crypto keys (not even the SE firmware has access to the key material, it's just allowed to run the circuits). Check out the iOS Security Guide whitepaper.
deleted 7y ago
[deleted]
fpoling 7y ago
It greatly helps Apple that T2 is a separated chip specially designed to do one function well, that is to do crypto in a secure way even in presence of physical attacks. How to do that has been known for quite some time. For example, modern SIM cards or cards for satellite tv are very secure and a physical attack is possible if one is willing to spend like over 100K per card. What Intel is trying to do is to allow a general purpose secure computing with minimal extra cost. This is relatively new and as various bugs demonstrates may not even archivable. I.e. it may be possible to create provably secure chip, but its cost will make it a niche product.
- baybal2 7y ago
  > physical attack is possible if one is willing to spend like over 100K per card. Firmware recovery from "hardened" microcontrollers costs $15-25k here, and even that's most likely a "special foreigner price"
  - baby 7y ago
    It’s not about firmware recovery: it’s about tampering it in a non-intrusive way OR extracting keys from its secured non volatile memory.
    - baybal2 7y ago
      Yes, MCU with intentionally hardened flash blocks are what those firmware recoverers specialize. They do things like gemalto chips sim and credit cards.
      - baby 7y ago
        the firmware should not be in internal flash though, where the keys are
- baby 7y ago
  It looks to me that having a standalone chip is not great in general due to hardware attacks: you can easily MITM the system bus for example. Whereas a number of attacks become much harder once you use an integrated secure element. The form factor of the iPhone of course almost makes the T2 secure enclave an integrated secure module. I also don’t think hardware attacks are really considered anyway (and as we see most researchers focus on software attacks)

matheusmoreira 7y ago

> Expect a lot more attacks like this to come out in the future! Hopefully SGX will be so utterly broken they'll never make anything like it ever again.

josteink 7y ago
Every time someone has uncovered a defect in Intel’s highest authoritative security-component, the answer has always been to add yet another, even more privileged component on top of that, to fix things “once and for all”. The current standing is a overly complex Rube Goldberg contraption obviously not fit to the task at hand. And Intel can’t or won’t fix it because if compatibility. And since each new component is even more privileged, it automatically becomes an even more valuable target to hack. So expect the contraption to get worse, not better. Even if everyone (probably Intel engineers too) agrees it’s the wrong thing to do.

lima 7y ago

AMD SEV has the same problem, with an even larger attack surface. But - at least it's compatible with the rest of the world, since it runs ordinary VMs, and can be used as a drop-in defense-in-depth measure. Intel SGX, on the other hand, is a severely constrained alien environment and porting stuff to run in SGX is a massive undertaking, requiring special compilers and SDKs. The cost-benefit calculation does not add up, given that it does not provide the level of security it claims to have. I wouldn't be surprised if SEV will eventually be adopted as the industry standard, while SGX disappears into irrelevance.